ZTE confirms security hole in U.S. phone